Lucene search

Alpine Linux Development TeamALPINE:CVE-2020-27569

HistoryApr 21, 2021 - 10:15 p.m.

CVE-2020-27569

2021-04-2122:15:17

Alpine Linux Development Team

security.alpinelinux.org

cve-2020-27569

aviatrix vpn client

arbitrary file write

vpn service

world writable

gain write access

unix

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

7.9

Confidence

High

EPSS

0.001

Percentile

30.6%

JSON

Arbitrary File Write exists in Aviatrix VPN Client 2.8.2 and earlier. The VPN service writes logs to a location that is world writable and can be leveraged to gain write access to any file on the system.

OSVersionArchitecturePackageVersionFilename
Alpineedge-mainnoarchopenvpn< 0UNKNOWN
Alpine3.10-mainnoarchopenvpn< 0UNKNOWN
Alpine3.11-mainnoarchopenvpn< 0UNKNOWN
Alpine3.12-mainnoarchopenvpn< 0UNKNOWN
Alpine3.13-mainnoarchopenvpn< 0UNKNOWN
Alpine3.14-mainnoarchopenvpn< 0UNKNOWN
Alpine3.15-mainnoarchopenvpn< 0UNKNOWN
Alpine3.16-mainnoarchopenvpn< 0UNKNOWN
Alpine3.17-mainnoarchopenvpn< 0UNKNOWN
Alpine3.18-mainnoarchopenvpn< 0UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Alpine	edge-main	noarch	openvpn	< 0	UNKNOWN
Alpine	3.10-main	noarch	openvpn	< 0	UNKNOWN
Alpine	3.11-main	noarch	openvpn	< 0	UNKNOWN
Alpine	3.12-main	noarch	openvpn	< 0	UNKNOWN
Alpine	3.13-main	noarch	openvpn	< 0	UNKNOWN
Alpine	3.14-main	noarch	openvpn	< 0	UNKNOWN
Alpine	3.15-main	noarch	openvpn	< 0	UNKNOWN
Alpine	3.16-main	noarch	openvpn	< 0	UNKNOWN
Alpine	3.17-main	noarch	openvpn	< 0	UNKNOWN
Alpine	3.18-main	noarch	openvpn	< 0	UNKNOWN

Rows per page:

1-10 of 121

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

7.9

Confidence

High

EPSS

0.001

Percentile

30.6%

JSON

Related for ALPINE:CVE-2020-27569